2 files changed, 3 insertions, 3 deletions

diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 0ccd1567f51f..e4fdfaa2b9b2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -43,7 +43,7 @@ int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
         int i;
 
         for (i = 0; i < STA_KEY_MAX_NUM; i++)
-                if (test_and_set_bit(i, &priv->ucode_key_table))
+                if (!test_and_set_bit(i, &priv->ucode_key_table))
                         return i;
 
         return -1;
@@ -243,6 +243,8 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         priv->stations[sta_id].keyinfo.alg = keyconf->alg;
         priv->stations[sta_id].keyinfo.conf = keyconf;
         priv->stations[sta_id].keyinfo.keylen = 16;
+        priv->stations[sta_id].sta.key.key_offset =
+                                 iwl_get_free_ucode_key_index(priv);
 
         /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 745b462103bd..0eb4220f035f 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -6810,8 +6810,6 @@ static void iwl4965_mac_update_tkip_key(struct ieee80211_hw *hw,
 
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        priv->stations[sta_id].sta.key.key_offset =
-                                iwl_get_free_ucode_key_index(priv);
         priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;